Time series metric data modeling and prediction

ABSTRACT

A system that utilizes a plurality of time series of metric data to more accurately detect anomalies and model and predict metric values. Streams of time series metric data are processed to generate a set of independent metrics. In some instances, the present system may automatically analyze thousands of real-time streams. Advanced machine learning and statistical techniques are used to automatically find anomalies and outliers from the independent metrics by learning latent and hidden patterns in the metrics. The trends of each metric may also be analyzed and the trends for each characteristic may be learned. The system can automatically detect latent and hidden patterns of metrics including weekly, daily, holiday and other application specific patterns. Anomaly detection is important to maintaining system health and predicted values are important for customers to monitor and make planning and decisions in a principled and quantitative way.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/814,815, titled “Time Series Metric Data Modeling and Prediction,”filed, Jul. 31, 2015, the disclosure of which is incorporated herein byreference.

BACKGROUND

The World Wide Web has expanded to provide numerous web services toconsumers. The web services may be provided by a web application whichuses multiple services and applications to handle a transaction. Theapplications may be distributed over several machines, making thetopology of the machines that provide the service more difficult totrack and monitor.

Monitoring a web application helps to provide insight regarding bottlenecks in communication, communication failures and other informationregarding performance of the services that provide the web application.Most application monitoring tools provide a standard report regardingapplication performance. Though the typical report may be helpful formost users, it may not provide the particular information that anadministrator wants to know.

Metric production an anomaly detection is often performed based on asingle metric history. Anomaly detection using a single metric providesfor a very limited view of the health of a system from which the metricis retrieved. As such, this is not always an accurate method todetermine the health of a system. What is needed is an improved methodfor predicting and detecting anomalies for the monitored system.

SUMMARY

The present technology, roughly described, utilizes a plurality ofmetrics to perform a more accurate prediction and anomaly detectionanalysis. A set of time series of metric data are analyzed to generate aset of independent metrics. The analysis may include performingcomponent analysis techniques to generate independent metrics from theoriginal metrics. The independent metrics are then processed by wavelettransformation to generate a series of average values over differentsets of data, when each data is associated with metadata such as time,location, and other metadata. A prediction of a future time may be madeby generating a value that corresponds, for example as an average, toprevious values with similar metadata to the expected for the predictedvalue. The predicted value is then process with a reverse wavetransformation and a reverse component analysis technique. This reverseprocess generates a prediction in terms of the original metrics from theindependent metrics for which the prediction was first generated. Whenthe actual metric is generated at the predicted time, the actual valueis compared to the predicted value. If the difference is greater than athreshold, and anomaly is determined to have occurred. If a metricexperiences a pattern that is part of a larger multi-metric patternassociated with a condition of concern or interest, an alert isgenerated.

An embodiment may include a method for detecting an anomaly intime-series data. A plurality of time series of original metric data maybe received. A component analysis may be performed to generate aplurality of time series of independent metric data. A function may beperformed to provide coefficients having a varying granularity for theplurality of time series of independent metric data. A value may bepredicted for the independent metric time series data based on thevarying granularity coefficients. The predicted value for theindependent metric time series data may be converted to an originalmetric data value. The actual value of the original metric time seriesdata may be determined to be an anomaly if the actual value for themetric differs from the predicted value for the metric by more than athreshold.

An embodiment may include a system for detecting an anomaly intime-series data. The system may include a processor, memory, and one ormore modules stored in memory and executable by the processor. Whenexecuted, the modules may receive a plurality of time series of originalmetric data, perform component analysis to generate a plurality of timeseries of independent metric data, perform a function to providecoefficients having a varying granularity for the plurality of timeseries of independent metric data, predict a value for the independentmetric time series data based on the varying granularity coefficients,convert the predicted value for the independent metric time series datato an original metric data value, and determine the actual value of theoriginal metric time series data is an anomaly if the actual value forthe metric differs from the predicted value for the metric by more thana threshold.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a system for predicting metric values anddetermining an anomaly.

FIG. 2 is a block diagram of a metric analyzer

FIG. 3 is a method for generating and anomaly.

FIG. 4 is a block diagram of a component analyzer.

FIG. 5 is an illustration of a time series of independent data to beprocessed by a wavelet transform.

FIG. 6 is an illustration of a tree of data generated by performing awavelet transform on time series data.

FIG. 7 is an example of a predicted metric based on independent metricdata and wavelet transform data.

FIG. 8 is a method for detecting and anomaly based on a predictedoriginal metric.

FIG. 9 say method for generating alerts based on predicted originalmetrics.

FIG. 10 is a graphical illustration of a series of time series data ofmetrics associated with an event.

FIG. 11 is a block diagram of a computing environment for use with thepresent technology.

DETAILED DESCRIPTION

The present technology, roughly described, utilizes a plurality ofmetrics to more accurately detect anomalies and model and predict metricvalues. Streams of time series metric data are processed to generate aset of independent metrics. In some instances, the present system mayautomatically analyze thousands of real-time streams. Advanced machinelearning and statistical techniques are used to automatically findanomalies and outliers from the independent metrics by learning latentand hidden patterns in the metrics. The trends of each metric may alsobe analyzed and the trends for each characteristic may be learned. Thesystem can automatically detect latent and hidden patterns of metricsincluding weekly, daily, holiday and other application specificpatterns. Anomaly detection is important to maintaining system healthand predicted values are important for customers to monitor and makeplanning and decisions in a principled and quantitative way.

To detect anomalies, real-time time series metric data streams areprocessed by component analysis techniques and singular valuedecomposition. These techniques generate one or more time series ofindependent metrics from the original metric streams. The decompositionof the original metric streams into the independent metric streamsallows for automatic extraction of meaningful latent patterns thatrepresent hidden and latent aspects of the metrics. This allows foranalysis of the metric patterns to determine a seasonal or periodicchange in metric values versus a true anomaly.

The independent metrics may then be processed by discrete wavelettransform (DWT) to generate wavelet coefficients. The coefficientswavelet coefficients represent patters for the metrics with differentgranularity, and may thus represent the latent characteristics of themetrics. The system may automatically learn weights associated withwavelet coefficients using an algorithm on recursive least squares (RLS)that works efficiently for fast real-time metric streams. Through thisautomated process, the present system can accurately and efficientlypredict future metric values and provide insights to users in areas suchas capacity planning, revenue forecasting, performance monitoring, andso on.

FIG. 1 is a block diagram of a system for correlating an application andnetwork performance data. System 100 of FIG. 1 includes client device105 and 192, mobile device 115, network 120, network server 125,application servers 130, 140, 150 and 160, asynchronous network machine170, data stores 180 and 185, controller 190, and data collection server195.

Client device 105 may include network browser 110 and be implemented asa computing device, such as for example a laptop, desktop, workstation,or some other computing device. Network browser 110 may be a clientapplication for viewing content provided by an application server, suchas application server 130 via network server 125 over network 120.

Network browser 110 may include agent 112. Agent 112 may be installed onnetwork browser 110 and/or client 105 as a network browser add-on,downloading the application to the server, or in some other manner.Agent 112 may be executed to monitor network browser 110, the operationsystem of client 105, and any other application, API, or other componentof client 105. Agent 112 may determine network browser navigation timingmetrics, access browser cookies, monitor code, and transmit data to datacollection 160, controller 190, or another device. Agent 112 may performother operations related to monitoring a request or a network at client105 as discussed herein.

Mobile device 115 is connected to network 120 and may be implemented asa portable device suitable for sending and receiving content over anetwork, such as for example a mobile phone, smart phone, tabletcomputer, or other portable device. Both client device 105 and mobiledevice 115 may include hardware and/or software configured to access aweb service provided by network server 125.

Mobile device 115 may include network browser 117 and an agent 119.Agent 119 may reside in and/or communicate with network browser 117, aswell as communicate with other applications, an operating system, APIsand other hardware and software on mobile device 115. Agent 119 may havesimilar functionality as that described herein for agent 112 on client105, and may repot data to data collection server 160 and/or controller190.

Network 120 may facilitate communication of data between differentservers, devices and machines of system 100 (some connections shown withlines to network 120, some not shown). The network may be implemented asa private network, public network, intranet, the Internet, a cellularnetwork, Wi-Fi network, VoIP network, or a combination of one or more ofthese networks. The network 120 may include one or more machines such asload balance machines and other machines.

Network server 125 is connected to network 120 and may receive andprocess requests received over network 120. Network server 125 may beimplemented as one or more servers implementing a network service, andmay be implemented on the same machine as application server 130. Whennetwork 120 is the Internet, network server 125 may be implemented as aweb server. Network server 125 and application server 130 may beimplemented on separate or the same server or machine.

Application server 130 communicates with network server 125, applicationservers 140 and 150, and controller 190. Application server 130 may alsocommunicate with other machines and devices (not illustrated in FIG. 1).Application server 130 may host an application or portions of adistributed application. The host application 132 may be in one of manyplatforms, such as for example a Java, PHP, .NET, Node.JS, beimplemented as a Java virtual machine, or include some other host type.Application server 130 may also include one or more agents 134 (i.e.“modules”), including a language agent, machine agent, and networkagent, and other software modules. Application server 130 may beimplemented as one server or multiple servers as illustrated in FIG. 1.

Application 132 and other software on application server 130 may beinstrumented using byte code insertion, or byte code instrumentation(BCI), to modify the object code of the application or other software.The instrumented object code may include code used to detect callsreceived by application 132, calls sent by application 132, andcommunicate with agent 134 during execution of the application. BCI mayalso be used to monitor one or more sockets of the application and/orapplication server in order to monitor the socket and capture packetscoming over the socket.

In some embodiments, server 130 may include applications and/or codeother than a virtual machine. For example, server 130 may include Javacode, .NET code, PHP code, Ruby code, C code or other code to implementapplications and process requests received from a remote source.

Agents 134 on application server 130 may be installed, downloaded,embedded, or otherwise provided on application server 130. For example,agents 134 may be provided in server 130 by instrumentation of objectcode, downloading the agents to the server, or in some other manner.Agents 134 may be executed to monitor application server 130, monitorcode running in a or a virtual machine 132 (or other program language,such as a PHP, .NET, or C program), machine resources, network layerdata, and communicate with byte instrumented code on application server130 and one or more applications on application server 130.

Each of agents 134, 144, 154 and 164 may include one or more agents,such as a language agents, machine agents, and network agents. Alanguage agent may be a type of agent that is suitable to run on aparticular host. Examples of language agents include a JAVA agent, .Netagent, PHP agent, and other agents. The machine agent may collect datafrom a particular machine on which it is installed. A network agent maycapture network information, such as data collected from a socket.

Agent 134 may detect operations such as receiving calls and sendingrequests by application server 130, resource usage, and incomingpackets. Agent 134 may receive data, process the data, for example byaggregating data into metrics, and transmit the data and/or metrics tocontroller 190. Agent 134 may perform other operations related tomonitoring applications and application server 130 as discussed herein.For example, agent 134 may identify other applications, share businesstransaction data, aggregate detected runtime data, and other operations.

An agent may operate to monitor a node, tier or nodes or other entity. Anode may be a software program or a hardware component (memory,processor, and so on). A tier of nodes may include a plurality of nodeswhich may process a similar business transaction, may be located on thesame server, may be associated with each other in some other way, or maynot be associated with each other.

Agent 134 may create a request identifier for a request received byserver 130 (for example, a request received by a client 105 or 115associated with a user or another source). The request identifier may besent to client 105 or mobile device 115, whichever device sent therequest. In embodiments, the request identifier may be created when adata is collected and analyzed for a particular business transaction.Additional information regarding collecting data for analysis isdiscussed in U.S. patent application no. U.S. patent application Ser.No. 12/878,919, titled “Monitoring Distributed Web ApplicationTransactions,” filed on Sep. 9, 2010, U.S. Pat. No. 8,938,533, titled“Automatic Capture of Diagnostic Data Based on Transaction BehaviorLearning,” filed on Jul. 22, 2011, and U.S. patent application Ser. No.13/365,171, titled “Automatic Capture of Detailed Analysis Informationfor Web Application Outliers with Very Low Overhead,” filed on Feb. 2,2012, the disclosures of which are incorporated herein by reference.

Each of application servers 140, 150 and 160 may include an applicationand agents. Each application may run on the corresponding applicationserver. Each of applications 142, 152 and 162 on application servers140-160 may operate similarly to application 132 and perform at least aportion of a distributed business transaction. Agents 144, 154 and 164may monitor applications 142-162, collect and process data at runtime,and communicate with controller 190. The applications 132, 142, 152 and162 may communicate with each other as part of performing a distributedtransaction. In particular each application may call any application ormethod of another virtual machine.

Asynchronous network machine 170 may engage in asynchronouscommunications with one or more application servers, such as applicationserver 150 and 160. For example, application server 150 may transmitseveral calls or messages to an asynchronous network machine. Ratherthan communicate back to application server 150, the asynchronousnetwork machine may process the messages and eventually provide aresponse, such as a processed message, to application server 160.Because there is no return message from the asynchronous network machineto application server 150, the communications between them areasynchronous.

Data stores 180 and 185 may each be accessed by application servers suchas application server 150. Data store 185 may also be accessed byapplication server 150. Each of data stores 180 and 185 may store data,process data, and return queries received from an application server.Each of data stores 180 and 185 may or may not include an agent.

Controller 190 may control and manage monitoring of businesstransactions distributed over application servers 130-160. In someembodiments, controller 190 may receive application data, including dataassociated with monitoring client requests at client 105 and mobiledevice 115, from data collection server 160. In some embodiments,controller 190 may receive application monitoring data, machinemonitoring data, and network data from each of agents 112, 119, 134, 144and 154. Controller 190 may associate portions of business transactiondata, communicate with agents to configure collection of data, andprovide performance data and reporting through an interface. Theinterface may be viewed as a web-based interface viewable by clientdevice 192, which may be a mobile device, client device, or any otherplatform for viewing an interface provided by controller 190. In someembodiments, a client device 192 may directly communicate withcontroller 190 to view an interface for monitoring data.

Client device 192 may include any computing device, including a mobiledevice or a client computer such as a desktop, work station or othercomputing device. Client computer 192 may communicate with controller190 to create and view a custom interface. In some embodiments,controller 190 provides an interface for creating and viewing the custominterface as content page, e.g. a web page, which may be provided to andrendered through a network browser application on client device 192.

The system of FIG. 1 may also include metric analyzer 197, which maycommunicate with controller 190 and any agent, including agents 134,144, 154, and 164 (not all connections shown in FIG. 1). The metricanalyzer 197 may process metrics to determine anomalies, performmodeling, predict values, and generate alerts. Metric analyzer 197 maybe implemented as a separate machine in communication with differentmachines of the system of FIG. 1, may be implemented in controller 190,or may be distributed over multiple machines in the system of FIG. 1.

Analyzer 197 may create independent metrics from original metrics usingcomponent analysis techniques such as principal component analysis (PCA)and independent component analysis (ICA), as well as perform singularvalue decomposition (SVD) on metric values. The resulting independentmetric streams may then be processed using discrete waveformtransformation (DWT) to generate wavelet coefficients having differentlevels of granularity. The wavelet coefficients may be then by beprocessed using a recursive least square (RLS) algorithm to learnweighting of the coefficients. The weighted wavelet coefficients may beused to predict future values of independent metrics and thecorresponding original metrics. In particular, the metric analyzer mayreverse the wavelet transformation and component analysis techniques toprovide the prediction in terms of the original metrics. Once apredicted metric has an actual value, an anomaly may be detected whenthe actual metric is determined and turns out to be greater than thepredicted metric by a particular threshold.

FIG. 2 is a block diagram of metric analyzer 210. Metric analyzer 210includes component analyzer 220, wavelet engine 230, metric prediction240, data store 250, and pattern analysis to 60. Component analyzer 220may perform composition analysis techniques and other techniques tomultiple time series of metric data to generate independent time seriesof metric data. The composition techniques may include PCA and ICA, andother techniques may include singular value decomposition (SVD). Theresulting independent time series of metric data will include latentpatterns in the input group of metrics.

More detail for a component analyzer is shown in FIG. 4. As shown inFIG. 4, the metrics received by the component analyzer may be any typeof metric, including a metric generated by a language agent thatmonitors an application, a machine agent that monitors a physicalmachine, and a network agent that monitors a network. In the exampleillustrated in FIG. 4, metrics of CPU cycles and network latency arereceived by the component analyzer 410. After being processed by PCA,ICA and SVD, one or more independent metrics may be generated from theoriginal metrics input into the analyzer 410. In the example shown inFIG. 4, three independent metrics are generated after receiving the twooriginal metrics. In some implementations, the number of originalmetrics that may be input into a component analyzer may up to, and over,a thousand real time time-series metric data streams.

Returning to FIG. 2, once independent metrics are generated by thecomponent analyzer, wavelet engine 230 may perform a discrete wavelettransform (DWT) on the independent metrics to generate waveletcoefficients. The wavelet coefficients may be viewed as a tree ofvalues, with the parent node having a large granularity and the nodesfurthest from the root node having a small granularity. FIG. 5illustrates a time series of data for a particular independent metric.The tree structure generated through DWT is illustrated in FIG. 6. Insome instances, each value in the tree is derived from time series dataassociated with its parent node, for example as an average of half thetime series data associated with its parent node. In one implementation,for example, the root note 610 is taken as the average of the timeseries values between point A and point B. The child nodes of AB aretaken as the average of half the time series values that make up Athrough B. Thus, half of A-B includes time series values A-C. The otherchild of the root node is generated from the average of time seriesvalues from C-B. The child nodes of AC and CB comprise the second levelof granularity at level 630. Similarly, level of child nodes may each bebroken up into two child notes for each child. This is shown at childlevel 640. For example, child AC may be divided into children AD and DC.Child AD is an average of the time series values from point A to pointD. Similarly, in the child level 640, child AD may be broken up intovalues AD and ED, which each include the average of the time seriesvalues in half of the values associated with AD.

Returning to FIG. 2, metric prediction module 240 may be used to predicta future value of a metric once the wavelet engine values have beengenerated. Metric prediction 240 may perform recursive least squares(RLS) on the wavelet coefficients to learn weights of the differentcoefficients with different granularities. The prediction module 240 maythen generate a predicted value for the independent metric time seriesdata based on the weighted coefficients. To generate predicted values,local data associated with the time for the prediction is used to findcoefficients that are relevant to the prediction. For example, if aprediction for the night before a Holiday at 8 pm is desired, theweighted coefficients that correspond to similar such situations may beused to generate the prediction. The predicted value may then undergo areverse wavelet transform by wavelet engine 230, followed by a reversecomponent analysis by analyzer 220 to generate the metric prediction interms of the original metric.

Data store 250 may store data and communicate with component analyzer220, wavelet engine 230, metric prediction 240, pattern analysis 260,and any other portion of metric analyzer 210. Datastore 220 may storeoriginal metric data, independent metric data, predicted data, treedata, and other data and information associated with processingperformed at metric analyzer 210.

Pattern analysis 260 may analyze a pattern of metrics to detect acondition or event. In some instances, a certain condition may causepatterns in a group of metrics. Often times, the condition degrades theperformance of the system but certain parts of the system experience thedegraded performance later than other parts. Pattern analysis 260 maystore these patterns for a group of metrics, and may provide an alertwhen the pattern first appears to be displayed by the first metric. Thepattern analysis may be may be performed on the original metrics orindependent metrics provided by component analyzer 220. Additionally,the pattern analysis may be performed on current metrics as well aspredicted metrics output by component analyzer 220.

FIG. 3 is a method for detecting an anomaly in a time series of metricdata. First, a plurality of time series of metric data is received atstep 310. The metrics may be received by the metric analysis module andmay be calculated for several types of monitored processes and systems,such as for example application data, machine data, network data, andother data over time.

Next, a component analysis is performed on the received metrics togenerate independent metrics at step 320. The component analysis mayinclude performing PCA, ICA, as well as SVD on the received originalmetrics. Performing one or more component analysis techniques onreceived original metric time series data may result in generating oneor more independent time series of metric data. As shown in FIG. 4, oneor more original metric time series data may be received by a componentanalyzer, the original metrics may be process, with the resultinggeneration of one or more independent metric times series data.

A discrete wavelet transform may be performed on the independent metricsat step 330. The DWT may provide an output of wavelet coefficientshaving different levels of granularity. As shown in FIG. 6, theindependent metric time series shown in FIG. 5 may, when processed by awavelet transform, provide a hierarchical tree with a root node, childnodes, grandchild nodes, and so forth, such that each level of childnode reaching further away from the root node provides a greater levelof granularity.

A future value of the independent metrics may be predicted from theprevious independent metrics at step 340. To predict a future value ofan independent metric, the wavelet coefficients may be weighted, forexample using an RLS algorithm, and the desired time for the predictedmetric is determined. Previous wavelet coefficients with local data(such as day of the week, time) that is similar to the expected localdata for the predicted time is then used to determine waveletcoefficients and an appropriate level granularity from which to predictthe metric value. The selected weighted metrics values are then used todetermine the predicted metric value.

Once the predicted value of the independent metric is determined, thepredicted independent metrics are converted back to the predictedoriginal metrics format at step 340. Converting the predictedindependent metric to the predicted original metric includes performinga reverse discrete wavelet transform to provide independent metrics, andthen performing a reverse analysis of the PCA, ICA, SVD, and any othertechniques applied to the original metric data. The reverse componentanalysis results in a predicted value in the form of the originalmetric.

An anomaly may be detected in the predicted original metrics at step360. The anomaly may be detected at the time at which the metric waspredicted once the actual value of the metric is known. Comparing apredicted value to an actual value of the point time is discussed inmore detail with respect to the method of FIG. 8.

Alerts may be generated based on the predicted original metrics at step370. The alerts may be generated based on the recognition of a patternthat is associated with an alert event. Generating an alert based on apredicted original metric is discussed in more detail with respect tothe method of FIG. 9.

FIG. 8 is a method for detecting an anomaly based on predicted values ofa metric. The method of FIG. 8 provides more detail for step 360 of themethod of FIG. 3. First, a predicted value of a metric is stored at step810. The predicted value is generated by the metric analyzer and may bestored in datastore 250 of metric analyzer 210 or any other data storeof the system of FIG. 1, such as a store 180 or 185. Next, the actualvalue of the metric at a subsequent time is eventually collected at step820.

The predicted value and the actual value for the original metric arecompared at step 830. If the actual value differs from the predictedvalue by more than a threshold, the actual value is determined to be ananomaly at step 840. The threshold may include a percentage of thepredicted value, such as plus or minus 10% of the predicted metricvalue, a number of standard deviations such as for example a secondstandard deviation, or some other range in relation to the predictedmetric value. If an anomaly is indeed detected, the system may providean alert to a user or administrator, such as for example through a userinterface, through a messaging system, or in some other manner.

FIG. 9 is a method for generating alerts based on a predicted originalmetric. A pattern may be detected in the first metric of a set ofcorrelated metrics at step 910. In some instances, a condition maycorrespond to a particular pattern in a set of metrics. For example,FIG. 10 illustrates a graph of metric values for a condition associatedwith an outage for a particular application. An outage may correspond touncharacteristic spikes in metric values for several metrics, such as acentral processing unit (CPU) usage, database processing time, and anapplication response time.

Next, the detected pattern may be compared to a stored pattern for thecorrelated metric at step 920. In this pattern of metrics associatedwith an application outage, the CPU may experience an uncharacteristicspike in CPU usage metrics at a first point in time, a spike in databaseresponse time metrics at a second and subsequent time, and anuncharacteristic spike in application response time metric values at apoint time after the spike associated with the database response time.This pattern of metric values for an outage is illustrated in FIG. 10.By monitoring these metric values in relation to each other, an outagemay be detected early through monitoring actual or predicted values ofone of a plurality of metrics tied to a condition or event. In someinstances, the metrics forming the pattern may be associated withindependent metrics generated via component processing of originalmetrics rather than analyzing the original metrics themselves. In anycase, if the condition associated with the pattern of metric behavior isdetected early enough, a user may be notified to monitor the resource,application, network, or other metrics such that if the condition istruly occurring, it may be quickly addressed by a user.

A determination is made that a match exists between the detected patternand the stored pattern at step 920. The match may be based on one ormore metrics that form the pattern. Hence, the match may be based onjust the CPU metric, the CPU and the database metric, or in some othercombination of metrics. An alert may be generated and transmitted to auser regarding the pattern match and subsequent patterns at step 940.Once the match is detected, the user may be notified with an alert thata power outage may be occurring which will affect the performance of thedatabase and the application, or other nodes or resources involved withthe particular outage, and that action should be taken to prevent thefallout cause by the notes and resources affected by the power outage orother condition associated with the pattern of metrics.

FIG. 11 is a block diagram of a system for implementing the presenttechnology. System 1100 of FIG. 11 may be implemented in the contexts ofthe likes of client computer 105 and 192, servers 125, 130, 140, 150,160, and 197, machine 170, data stores 180 and 190, and controller 190.The computing system 1100 of FIG. 11 includes one or more processors1110 and memory 1120. Main memory 1120 stores, in part, instructions anddata for execution by processor 1110. Main memory 1120 can store theexecutable code when in operation. The system 1100 of FIG. 11 furtherincludes a mass storage device 1130, portable storage medium drive(s)1140, output devices 1150, user input devices 1160, a graphics display1170, and peripheral devices 1180.

The components shown in FIG. 11 are depicted as being connected via asingle bus 1190. However, the components may be connected through one ormore data transport means. For example, processor unit 1110 and mainmemory 1120 may be connected via a local microprocessor bus, and themass storage device 1130, peripheral device(s) 1180, portable storagedevice 1140, and display system 1170 may be connected via one or moreinput/output (I/O) buses.

Mass storage device 1130, which may be implemented with a magnetic diskdrive, an optical disk drive, a flash drive, or other device, is anon-volatile storage device for storing data and instructions for use byprocessor unit 1110. Mass storage device 1130 can store the systemsoftware for implementing embodiments of the present invention forpurposes of loading that software into main memory 1120.

Portable storage device 1140 operates in conjunction with a portablenon-volatile storage medium, such as a floppy disk, compact disk orDigital video disc, USB drive, memory card or stick, or other portableor removable memory, to input and output data and code to and from thecomputer system 1100 of FIG. 11. The system software for implementingembodiments of the present invention may be stored on such a portablemedium and input to the computer system 1100 via the portable storagedevice 1140.

Input devices 1160 provide a portion of a user interface. Input devices1160 may include an alpha-numeric keypad, such as a keyboard, forinputting alpha-numeric and other information, a pointing device such asa mouse, a trackball, stylus, cursor direction keys, microphone,touch-screen, accelerometer, and other input devices Additionally, thesystem 1100 as shown in FIG. 11 includes output devices 1150. Examplesof suitable output devices include speakers, printers, networkinterfaces, and monitors.

Display system 1170 may include a liquid crystal display (LCD) or othersuitable display device. Display system 1170 receives textual andgraphical information, and processes the information for output to thedisplay device. Display system 1170 may also receive input as atouch-screen.

Peripherals 1180 may include any type of computer support device to addadditional functionality to the computer system. For example, peripheraldevice(s) 1180 may include a modem or a router, printer, and otherdevice.

The system of 1100 may also include, in some implementations, antennas,radio transmitters and radio receivers 1190. The antennas and radios maybe implemented in devices such as smart phones, tablets, and otherdevices that may communicate wirelessly. The one or more antennas mayoperate at one or more radio frequencies suitable to send and receivedata over cellular networks, Wi-Fi networks, commercial device networkssuch as a Bluetooth devices, and other radio frequency networks. Thedevices may include one or more radio transmitters and receivers forprocessing signals sent and received using the antennas.

The components contained in the computer system 1100 of FIG. 11 arethose typically found in computer systems that may be suitable for usewith embodiments of the present invention and are intended to representa broad category of such computer components that are well known in theart. Thus, the computer system 1100 of FIG. 11 can be a personalcomputer, hand held computing device, smart phone, mobile computingdevice, workstation, server, minicomputer, mainframe computer, or anyother computing device. The computer can also include different busconfigurations, networked platforms, multi-processor platforms, etc.Various operating systems can be used including Unix, Linux, Windows,Macintosh OS, Android, and other suitable operating systems.

The foregoing detailed description of the technology herein has beenpresented for purposes of illustration and description. It is notintended to be exhaustive or to limit the technology to the precise formdisclosed. Many modifications and variations are possible in light ofthe above teaching. The described embodiments were chosen in order tobest explain the principles of the technology and its practicalapplication to thereby enable others skilled in the art to best utilizethe technology in various embodiments and with various modifications asare suited to the particular use contemplated. It is intended that thescope of the technology be defined by the claims appended hereto.

What is claimed is:
 1. A method for detecting an anomaly in time series data, comprising: receiving, by a machine, a plurality of time series of original metric data associated with different types of monitoring; generating a plurality of time series of independent metric data using the received plurality of time series of original metric data; generating coefficients using the plurality of time series of independent metric data; predicting a value for the plurality of time series of independent metric data for a future time point using the coefficients; determining a predicted value for the plurality of time series of original metric data using the predicted value for the plurality of time series of independent metric data; and detecting an anomaly in the plurality of time series of original metric data by comparing an actual value for the plurality of time series of original metric data received at the future time point with the predicted value for the plurality of time series of original metric data.
 2. The method of claim 1, wherein comparing the actual value for the plurality of time series of original metric data includes determining whether the received actual value for the plurality of time series of original metric data differs from the predicted value for the plurality of time series of original metric data by more than a threshold.
 3. The method of claim 1, wherein generating the plurality of time series of independent metric data includes performing principal component analysis or independent component analysis.
 4. The method of claim 1, wherein the plurality of time series of original metric data include a time series of metric data associated with monitored application and a time series of metric data associated with monitored user behavior.
 5. The method of claim 1, wherein generating the coefficients include performing a discrete waveform transformation function.
 6. The method of claim 1, wherein the coefficients include different levels of granularity.
 7. The method of claim 1, wherein predicting the value for the plurality of time series of independent metric data includes determining weighting of the coefficients.
 8. The method of claim 1, further comprising providing an alert for the detected anomaly.
 9. A system for detecting an anomaly in time-series data, comprising: a server including a memory and a processor; and one or more modules stored in the memory and executed by the processor to perform operations including: generating a plurality of time series of independent metric data by processing a plurality of time series of original metric data associated with different types of monitored processes; detecting a latent pattern in the plurality of time series of original metric data using the generated plurality of time series of independent metric data; determining one or more anomalies using the detected pattern; and providing an alert for the determined one or more anomalies.
 10. The system of claim 9, wherein a number of the plurality of time series of independent metric data is different from a number of the plurality of time series of original metric data associated with different types of monitored processes.
 11. The system of claim 9, wherein the detected pattern is used to detect a condition.
 12. The system of claim 11, wherein the condition includes a performance degradation condition.
 13. The system of claim 9, wherein the detected pattern includes an application specific pattern.
 14. The system of claim 9, wherein detecting the pattern includes detecting a pattern in one metric of a set of correlated metrics in the plurality of time series of original metric data.
 15. The system of claim 9, including: generating coefficients using the plurality of time series of independent metric data; and predicting a value of the independent metric time series data for a future time point using the coefficients.
 16. The system of claim 15, including: determining a predicted value of the original metric data for the future time point using the predicted value of the independent metric time series data; and comparing an actual value of the original metric data received at the future time point with the predicted value of the original metric data.
 17. The system of claim 9, including: comparing the detected pattern against a stored pattern.
 18. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for detecting an anomaly in time series data, the method comprising: processing a plurality of time series of original metric data associated with different types of monitored processes; detecting a latent pattern in a set of correlated metrics in the plurality of time series of original metric data; comparing the detected pattern against a stored pattern; detecting a condition based on the comparison; and providing an alert for the detected condition.
 19. The non-transitory computer readable storage medium of claim 18, wherein the set of correlated metrics include a central processing unit usage, database processing time, and an application response time.
 20. The non-transitory computer readable storage medium of claim 18, wherein providing the alert includes a notification to monitor a specific resource, application, or network associated with the set of correlated metrics. 